Check for packet with truncated DTLS cookie.

Flip pointer comparison logic to avoid beyond-end-of-buffer pointers
to make it less likely a compiler will decide to screw you.

Based on parts of openssl commits
6f35f6deb5ca7daebe289f86477e061ce3ee5f46 and
89c2720298f875ac80777da2da88a64859775898

ok jsing@

1 files changed, 17 insertions, 12 deletions

diff --git a/src/lib/libssl/s3_srvr.c b/src/lib/libssl/s3_srvr.c
index 9fe96de53e..d2a03e05d2 100644
--- a/src/lib/libssl/s3_srvr.c
+++ b/src/lib/libssl/s3_srvr.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: s3_srvr.c,v 1.126 2016/05/30 13:42:54 beck Exp $ */
+/* $OpenBSD: s3_srvr.c,v 1.127 2016/09/22 07:17:41 guenther Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -776,21 +776,26 @@ ssl3_get_client_hello(SSL *s)
         }
 
         /*
-         * If we require cookies and this ClientHello doesn't
+         * If we require cookies (DTLS) and this ClientHello doesn't
          * contain one, just return since we do not want to
          * allocate any memory yet. So check cookie length...
          */
         if (SSL_get_options(s) & SSL_OP_COOKIE_EXCHANGE) {
                 unsigned int session_length, cookie_length;
 
+                if (p - d + SSL3_RANDOM_SIZE + 1 >= n)
+                        goto truncated;
                 session_length = *(p + SSL3_RANDOM_SIZE);
-                cookie_length = *(p + SSL3_RANDOM_SIZE + session_length + 1);
+
+                if (p - d + SSL3_RANDOM_SIZE + session_length + 1 >= n)
+                        goto truncated;
+                cookie_length = p[SSL3_RANDOM_SIZE + session_length + 1];
 
                 if (cookie_length == 0)
                         return (1);
         }
 
-        if (p + SSL3_RANDOM_SIZE + 1 - d > n)
+        if (p - d + SSL3_RANDOM_SIZE + 1 > n)
                 goto truncated;
 
         /* load the client random */
@@ -799,7 +804,7 @@ ssl3_get_client_hello(SSL *s)
 
         /* get the session-id */
         j= *(p++);
-        if (p + j - d > n)
+        if (p - d + j > n)
                 goto truncated;
 
         s->hit = 0;
@@ -839,7 +844,7 @@ ssl3_get_client_hello(SSL *s)
 
         if (SSL_IS_DTLS(s)) {
                 /* cookie stuff */
-                if (p + 1 - d > n)
+                if (p - d + 1 > n)
                         goto truncated;
                 cookie_len = *(p++);
 
@@ -856,7 +861,7 @@ ssl3_get_client_hello(SSL *s)
                         goto f_err;
                 }
 
-                if (p + cookie_len - d > n)
+                if (p - d + cookie_len > n)
                         goto truncated;
 
                 /* verify the cookie if appropriate option is set. */
@@ -888,7 +893,7 @@ ssl3_get_client_hello(SSL *s)
                 p += cookie_len;
         }
 
-        if (p + 2 - d > n)
+        if (p - d + 2 > n)
                 goto truncated;
         n2s(p, i);
         if ((i == 0) && (j != 0)) {
@@ -898,7 +903,7 @@ ssl3_get_client_hello(SSL *s)
                     SSL_R_NO_CIPHERS_SPECIFIED);
                 goto f_err;
         }
-        if (p + i - d > n)
+        if (p - d + i > n)
                 goto truncated;
         if (i > 0) {
                 if ((ciphers = ssl_bytes_to_cipher_list(s, p, i)) == NULL)
@@ -931,10 +936,10 @@ ssl3_get_client_hello(SSL *s)
         }
 
         /* compression */
-        if (p + 1 - d > n)
+        if (p - d + 1 > n)
                 goto truncated;
         i= *(p++);
-        if (p + i - d > n)
+        if (p - d + i > n)
                 goto truncated;
         for (j = 0; j < i; j++) {
                 if (p[j] == 0)
@@ -1655,7 +1660,7 @@ ssl3_get_client_key_exchange(SSL *s)
                         /* SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,SSL_R_BAD_RSA_DECRYPT); */
                 }
 
-                if (p + 2 - d > n)      /* needed in the SSL3 case */
+                if (p - d + 2 > n)      /* needed in the SSL3 case */
                         goto truncated;
                 if ((al == -1) && !((p[0] == (s->client_version >> 8)) &&
                     (p[1] == (s->client_version & 0xff)))) {